The name of this latest malware strain is a bit chilling. ICEPick-3PC was recently discovered by the Digital Security & Operations (DSO) team of The Media Trust, a digital risk management company. Not long ago, the team came across ICEPick-3PC, a malware strain that goes into action after a website has its third-party tools hacked. The sneaky element first discovered allowing these ICEPick-3PC hacks is a classic email phishing attack. The phishing emails offer recipients a free gift card from major retailers like Amazon and Walmart. All one has to do is provide some personal information and the gift card is on its way! PS…There are no gift cards, and your IP (Internet Protocol) address has just been hijacked.

Third-party software includes programs created by companies other than the operating system developers and are used by countless businesses for many different purposes. Some third-party software already has malware installed on it, which then infects devices. In this case, ICEPick-3PC prompts the malware using phishing attacks. According to a DSO researcher, the ice-cold heart of ICEPick-3PC is “…this malware has overcome such hurdles and even breaks through VPNs in order to intercept IPs, it enables bad actors to identify users’ device vulnerabilities, and leaves the devices wide open for exploit targeting and potential future attacks.” Keeping devices safe from ICEPick-3PC requires commitments to educate users about phishing emails and using safety measures against harmful third-party software.

Check before you click. Unless you’re 100% sure the email is from a trusted source, do some investigating. A minute or two spent confirming a sender can avoid a ton of headaches for you and your employer.

Never download files, click attachments or follow links in an email–especially if you can’t verify the sender. Attachments and files can be full of malware. Links to websites can’t be trusted and can lead to bogus sites designed to steal your sensitive information.

Avoid clicking on pop-ups as they also contain malware. Close the pop-up using the “x” found in a corner of the pop-up and never click on “unsubscribe” buttons–they can also hold malware.

Keep informed about the latest scams and trends of email phishing. Employers benefit greatly by ongoing cybersecurity training and education for employees.

So why do is significant that they steal IP addresses? Well, stealing an IP address allows hackers to launch future attacks against devices.

It really wasn’t Wal-Mart that exposed personal data of 1.3 million shoppers. But if you read the headlines and listen to the stories, you may think so. In fact, it was a third-party vendor to blame for this one. A security firm, Kromtech, discovered the breach. While Wal-Mart customers are indeed involved, it was a misconfigured Amazon cloud server belonging to a company called MBM Company Inc. that left the information publicly available and available to anyone who would like to use it; even without permission.

MBM Company, as it turns out, also runs a company that works with Wal-Mart and its jewelry-buying customers. The data that was inadvertently exposed from January 13, 2018 until just recently included names, addresses, phone numbers, email addresses, and unsecured passwords for the victims’ shopping accounts. The data went as far back as the year 2000.

When working with third-parties, you really lose come control of customer data. There is, and should be, an expectation that they will secure the data you are entrusting them with. However, as has been proven time and again, this isn’t always the case. See the recent Facebook incident, for example. If you hand over data to a third-party, make sure you know what they are doing with it. If you expect them to keep it secure, make sure they are signing off that they will indeed do that. Read the contractual fine print, find out their security plans, and hold them accountable when something happens to your customers’ or employees’ information. It’s as much your responsibility to find out this information as it theirs to secure the data.

Anyone with a Wal-Mart online shopping account should change the password now. Make sure to included upper and lower case letters, special characters, and numbers. It should be completely unique to that one site and not be easy to guess.

In addition, make sure to monitor your payment card charges for at least the next 12 months, until the card expires, or until a new one is issued. Report any potentially fraudulent charges right away.

If you have the option to set up multi-factor authentication (MFA) or two-factor authentication (2FA), do it on any account for which it’s available. This means that in order to get access to your account, you’ll not only need your login and password, but also some other method of authentication. This could be a random code that is sent via text or phone call, or a randomly generated number from a key-fob you may have received in the mail.

The jewelry company was called Limogés Jewelry. It not only partners with Wal-Mart, but also with many other stores including Amazon, Sears, Kmart, Target, and Overstock. If you use the same password with any of these, or any other online account for that matter, you’ll need to change that one too.

Research shows that your closest cybersecurity threat could be you. Studies have found that since 2015, cybercriminals have been gravitating to social engineering that exploits human nature. Emails are a favorite tool for many reasons and call for recipients to be on guard. Knowing what to look for and how to react to it are the key to avoiding becoming a victim of fraud, identity theft, or a data breach.

Email Phishing

A sense of urgency is the most popular and effective phishing hook. Anyemail requiring an urgent response is likely phishing bait.

Enable security filters for email programs. ISP’s (internet service providers) offer different filter level options. You can always change security settings if you need to. You may need to contact your provider to find out your options with this.

If you doubt the sender is legitimate but want to be sure, verify it with the company directly. Call or type the company URL (web address) into your browser window. Never use the URL provided in the email and never reply directly to a suspicious email message.

Always check that a site is secure. You should see “https” instead of “http” before the URL. Also, never give out any information on a website that doesn’t have the encrypted “lock” icon to the far left of the URL. In some cases, the text preceding the address may turn red if a site is suspect.

Spam Email

Spam emails are the cyber equivalent of junk mail (one look in your spam folder should be proof enough). The safest type of email spam is the unopened and deleted spam email. They’re annoying at best and harmful at worst – don’t let them fool you into being click bait.

Enable the spam filters offered by your ISP. There are usually different levels of spam filters offered, so use a level you’re comfortable with. If the default filter level isn’t sufficient, you should be able to increase it.

If you’re not expecting a link or attachment, don’t open it. Unwanted and unexpected emails are the spammer’s calling card. Hover your mouse over the sender’s URL and the link to verify that any sender is who they say they are and the link goes where you expect it to go. The URL’s should match. If they don’t, delete it.

Resist the temptation to open a spam email looking for an “unsubscribe” button or link. The unsubscribe options on many spam emails is a cyber thief favorite. It’s very possibly a ruse that can release a flood of malware for the “unsubscriber.” Instead, just report it as spam to your email provider when possible and delete it regardless.

Chrome Extensions Downloaded By Half A Million Users Found To Be Used For Click Fraud

Published January 22, 2018

Nyoogle. Stickies. Lite Bookmarks. They all sound like they could be some fun browser extensions to add onto your version of Chrome. Well, they aren’t, although 500,000 people downloaded them. Researchers at ICEBRG found that those and another called HTTP Request Header are likely being used in a click fraud scam. It was discovered that those extensions were visiting advertising-related web links, resulting in a neat little payday for fraudsters. But that’s not all that add-ons and extensions can be used for. This example shows how they can just as easily be used to install other, more dangerous types of malware too.

Click fraud is up and coming. Those who utilize this to make a buck get paid each time one of their ads is clicked. The ads are designed to direct to a particular website that pays the posters of the ads each time their ads go to the company’s website. It can be quite lucrative and it’s nearly impossible to catch those engaging in this type of fraudulent behavior, so the return on their malvertising investment is well worth the risk.

Users tend to trust the add-ons and extensions that go along with their favorite browsers, so attacks used in this way can be even more damaging. If you are doing some action on your computer or mobile device and a request pops up to install an add-on or extension, make sure it’s necessary before clicking the affirmative option. It’s better to cancel out, research what the extension is doing, and determine whether you can use the product without it first. If you can, don’t install it. The fewer of these extras you have attached to whatever browser you use, the better.

Were this method to be used to install ransomware, spyware, or other type of more malicious malware, a lot of damage can be done to the victims. So take some time to make sure you really want to click on ads you see as well. Certainly not all of them are malicious. In fact, most probably are not. But it only takes one click on a bad one for your computer or device to be compromised. It is worth the time to go directly to the website of the company in the ad to determine if you want to look at their products further.

Online shoppers are finding the cost of convenience may add up to much more than they bargained for. Holiday online shopping is heading into high gear and so are cybercriminals. Their opportunities for success abound with good-intentioned shoppers being none-the-wiser. While the Internet is sizzling with great buys and hard-to-find merchandise, holiday fervor is being eclipsed by cyber swindlers. The popular robot monkey toys, Fingerlings, are particularly popular as a counterfeit toy this season.

Demand for some of the hottest gifts this season is being met with an abundance of knock-offs. If a product comes from a third-party website, beware that you may not get what you ordered. Bogus products that don’t work properly, or at all, may be on their way. If that’s not bad enough, many of the original products are swept up in mass quantities by product pirates looking for trea$ure. They’re then sold on sites like Amazon and eBay at outrageous markups. The Better Business Bureau (BBB) strongly recommends “buyer beware.”

Along with the rise of counterfeit toys, cybersecurity concerns skyrocket. The BBB and cybersecurity firms warn online shoppers to heighten their security as well. Following basic guidelines can prevent a world of hurt to financial and other personal information being pirated. Email scams are rife with success. Check the BBB website https://www.bbb.org for more online shopping tips.

Email shipping and payment scams

Don’t respond to emails from shippers with subjects suggesting there’s a problem with shipping or processing your payment. No matter how legitimate it looks, it’s very possibly fake. Cyber crooks are looking to suck you into providing sensitive information by clicking on links and attachments claiming there’s an issue with your delivery, shipment, or purchase. They have even taken to using fake tracking numbers in hopes you’ll fall into the trap. Go directly to the website for the various shippers (FedEx, UPS, Amazon, USPS, etc.) by typing the URL yourself and entering the tracking number, making sure the security signals are in the address bar (lock icon, https://).

Gift card and contest scams

Emails saying you’ve won a gift card from Amazon or other retailers are a big draw for information thieves. Still other emails may provide a crazy-huge discount coupon or contest win. Clicking on those tempting links and attachments is an open invitation for malware. All manner of problems can ensure a crimp in anyone’s holiday.

The Payment processing company ACI Worldwide has warned retailers of a 30% increase in fraudulent activity this season. This is partially due to the uptick in data breaches, identity theft, and account takeover throughout the year and before. As a final check of the products you purchase, go to the manufacturer’s website and look at the logos and packaging to make sure it matches what you received. If it doesn’t, it could indicate a counterfeit product was sent to you.

A high-volume spam email campaign has been spotted running amok and it contains some dangerous malware. Recently, the malware HawkEye was found being sold on a publicly facing website and likely, that’s why it’s suddenly a popular tool for the bad actors. This one is capable of accomplishing many tasks to cause victims grief and the targets aren't limited to a specific industry, company size, or geographic location. It gets executed through phishing, of course.

HawkEye is typically associated with stealing login credentials, however it is very versatile. It can also:

Steal email passwords

Steal passwords from web browsers

Take screen shots

Log keystrokes (keylogger)

Steal from crypto currency wallets

It usually arrives in inboxes with a subject line that is related to current events. The idea is to bait people into opening the message. Once it is opened, an attachment is inside in the form of a Microsoft Word file (.docx) with a believable name, such as “invoice” or “order confirmation.” If that is clicked, another document opens with an “error” message alerting the user that the document didn’t properly open or perhaps it was “downloaded from old browser.” Then there is an icon to be clicked that finishes the malware’s execution.

Remember to look for clues to phishing such as misspelled words or improper language use. If an email subject is related to a current news event, but the attachment inside is an “invoice,” it should also throw up a red flag.

Any attachment or link that arrives unexpectedly should be met with a healthy dose of suspicion too.

Phishing isn’t going away any time soon. That’s because it works amazingly well for the hackers. Taking a little time to make an informed decision on whether or not to click can make a lot of difference in keeping you and your organization safe from threats such as HawkEye.

We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.

Chances are pretty good that you have heard the term business email compromise or BEC by now. It is a type of wire transfer fraud that the FBI has deemed one of the most prevalent types of scam going around these days. In 2017, there were over 15,690 complaints that resulted in total adjusted losses of more than $675 million. That is an 87% increase over 2016 and it is expected to continue to rise. The Identity Theft Resource Center (ITRC) reported that of the fraud related complaints reported in 2017, the most common type was wire transfer fraud.

Chances are pretty good that you have heard the term business email compromise or BEC by now. It is a type of wire transfer fraud that the FBI has deemed one of the most prevalent types of scam going around these days. In 2017, there were over 15,690 complaints that resulted in total adjusted losses of more than $675 million. That is an 87% increase over 2016 and it is expected to continue to rise. The Identity Theft Resource Center (ITRC) reported that of the fraud related complaints reported in 2017, the most common type was wire transfer fraud.

This Privacy Policy applies to and is provided on behalf of Stickley on Security. (collectively referred to as "We", "Us", or "Our") and describes Our information gathering
practices and policies in connection with this Site. We value your ("User", "You", or "Your") privacy and recognize the sensitivity of Your personal information. We are
committed to protecting Your personal information and using it only as appropriate to provide You with the best possible service, products, and opportunities. Use of this
Site constitutes consent to Our collection and use of personal data as outlined herein.

COLLECTION AND USE OF PERSONAL INFORMATION FROM SITE USERS

We collect personally identifiable information from Users who provide it to us for billing purposes. For example, We collect Your name, street address, city, state, zip
code, telephone number, email address, and financial information, such as a credit card number, if You use the Site to register or renew a license. We may use this
information to contact You regarding the status of Your account and orders placed, and to alert You to new information, products and services, events and other
opportunities. We recognize that You may wish to limit the ways in which You are contacted and provide You with opt-out options below. Information about Our experiences and
transactions with you, such as your payment history, types of services and/or products you purchased are not shared with organizations outside of Stickley on Security.

We will not disclose to third parties (that is, people and companies that are not affiliated with Us) individually identifying information, such as names, postal and e-mail
addresses, telephone numbers, and other personal information, except to the extent that it is necessary to process and provide You with Your order, license request or
other request. Your contact information may also be provided to the extent necessary to comply with applicable laws or legal processes (e.g., subpoenas), or to meet contractual obligations outlined in this policy, or to protect Our
rights or property. We will cooperate with all law enforcement authorities.

If Your order, license request or other request is processed by a third-party, or if You are provided with bulletin boards and chat rooms and/or email capabilities on
this Site, please note that in the event that You voluntarily disclose personally identifiable information in those instances, that information, along with any substantive
information disclosed in Your communication or post, can be collected, correlated and used by third parties. This may result in unsolicited messages from third parties. Such
activities are beyond Our control, and We encourage You to check the applicable privacy policy of such party when providing personally identifiable information.

For each visitor to this Site, Our server can detect and collect certain information, including the User's domain name and e-mail address, and can identify the Web pages the
User visited or accessed. We may use this information in order to measure interest in and use of the various areas of the site.

We do not knowingly solicit information from children and We do not knowingly market the Site or its services to children.

OPT-OUT

You may at any time opt out of having Your personal information used by Us to send You promotional correspondence by contacting Us via e-mail provided in the "Contact Us"
section below.

PROMOTION CODES

"Promotion codes" are offered by third-party affiliates of the Stickley on Security Training Videos. If you choose to include a "Promotion Code" when placing your order, the affiliate who is associated with that promotional code will receive your organizations name. They will NOT however receive any other information related to your account. The sharing of the organization name only applies when a "Promotion Code" is included during the order process.

USE OF COOKIES

1. First-party cookies
User input cookies to keep track of the user's input when filling online forms, shopping carts, etc., for the duration of a session, or persistent cookies limited to the duration of an operation such as purchase or trial;
User identification persistent cookies, to identify the user visited the website for the first time;
Authentication cookies, to identify the user once he has logged in, for the duration of a session;
user interface customization cookies such as time zone and shopping cart status info, for the duration of a session (or slightly longer).

2. Third-party cookies
social plug in content sharing cookies, for logged in members of a social network;
Google Analytics cookies to generate statistical data on how the visitor uses the website.

How do we use them?
Where strictly necessary. These cookies and other technologies are essential in order to enable the Services to provide the feature you have requested, such as remembering you have logged in.

For functionality. These cookies and similar technologies remember choices you make such as time zone and shopping cart info. We use these cookies to provide you with an experience more appropriate with your selections and to make your use of the Services more tailored.

For performance and analytics. These cookies and similar technologies collect information on how users interact with the Services and enable us to improve how the Services operate. For example, we use Google Analytics cookies to help us understand how visitors arrive at and browse our products, services and website to identify areas for improvement such as navigation, user experience, and marketing campaigns.

Social media cookies. These cookies are used when you share information using a social media sharing button or .like. button on our websites or you link your account or engage with our content on or through a social media site. The social network will record that you have done this. This information may be linked to targeting/advertising activities.

How can you opt-out?
To opt-out of our use of cookies, you can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from websites you visit. If you do not accept cookies, however, you may not be able to use our Services.

Updates to this Cookie Policy
This Cookie Policy may be updated from time to time. If we make any changes, we will notify you by revising the "effective starting" date at the top of this notice.

INFORMATION SECURITY AND CONFIDENTIALITY

We maintain physical, electronic and procedural safeguards to prevent the unauthorized release of or access to Your personal information. When We transfer and receive
certain types of sensitive information such as financial information, We redirect visitors to a secure server. We do not store or reuse Your credit card information. We do
not record or manager financial information about You (including credit card and other payment information). However, such precautions do not guarantee that this Site is
invulnerable to all security breaks. We make no warranty, guarantee, or representation that the use of this Site is protected from viruses, security threats, or other
vulnerabilities and that Your information will always be secure. We cannot guarantee the confidentiality of any communication or material transmitted to/from Us via the Site
or e-mail. Use of the Internet is solely at Your own risk and is subject to all applicable local, state, federal, and international laws and regulations.

THIRD PARTY PROCESSING

Stickley on Security uses the vendor Authorize.net to process all payment transactions. When making a purchase on this site, You also accept the Terms and Conditions and
Privacy Policy of Authorize.net.

CONTACT US

This Privacy Policy may be updated periodically and posted on this Site. It applies only to Our online practices and does not encompass other areas of the organization. We
reserve the right to change this Policy at any time by posting revisions. By accessing or using the Site, You agree to be bound by all of the Terms of this Privacy Policy as
posted at the time of Your access or use. We reserve the right to contact Users of the Site regarding changes to the Terms and Conditions generally, this Privacy Policy
specifically, or any other policies or agreements relevant to the Site's Users. If You have any questions about this Policy, You may email to:

Keep up with the latest cyber security news through our weekly Fraud News & Alerts updates.
Each week you will receive an email containing the latest cyber security news, tips and breach notifications.

Simply complete the form below and you're all set.

You're all set!

You will receive your first official security update email within the next week.
A welcome email has also just been sent to you. If you do not receive this email within the next few minutes, please check your Junk box or spam filter to confirm our emails are not being blocked.